CVE-2026-70477

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3

Description An unauthenticated remote attacker can execute arbitrary code in the context of the service account or the user running the server. The issue occurs when a chatflow uses a CSV Agent node, where the run() method of the CSV Agents class uses untrusted data to construct an LLM prompt. The resulting pythonCode is validated by the validatePythonCodeForDataFrame() function using a static regex blocklist before being executed in an unsandboxed Pyodide environment. Pyodide is a Python distribution for the browser and Node.js that, in this implementation, lacks isolation from the host operating system. Attackers can bypass the blocklist validator using obfuscation techniques such as string concatenation, chr() encoding, MRO traversal, or frame object inspection to execute malicious Python scripts.

Recommendations Update Flowise to version 3.1.3. As a temporary mitigation, restrict access to the CSV Agent node to minimize the risk of exploitation.